Add 'exists' filter to rollup

Elastic Stack Beats
1

Greetings,

I'm working with rollups of metricbeat data. In rollups we want to see only documents that contain a certain field such as system.cpu.total.pct. Can I add the filter directly to the rollup definition? I'd like to add a filter like this:

"filter":{
	"exists": {
		"field": "system.cpu.total.pct"
	}
}

However, this throws an error that says that filter is not a valid rollup field:

{
   "type": "x_content_parse_exception",
   "reason": "[37:5] [xpack/rollup/jobconfig] unknown field [filter], parser not found"
}

The reason we want to do this is that the rollup otherwise contains documents that have fields we don't care about. We also want them to have actual numerical values and not be "null."

Any suggestions will be appreciated! Thank you.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.